https://community.splunk.com/t5/Reporting/Spam-Alert/m-p/81505#M1845 <P>Hi all,</P> <P>I want to set up a spam alert in Splunk that will notify me if we receive excessive emails from a certain source eg 200 emails within a 1 hour timeframe. </P> <P>I was wondering if such an alert can be made and if so some guidance on how to do so.</P> <P>Thanks in Advance</P> Tue, 08 Jan 2013 22:45:58 GMT Splunker4Life 2013-01-08T22:45:58Z https://community.splunk.com/t5/Reporting/Spam-Alert/m-p/81505#M1845 <P>Hi all,</P> <P>I want to set up a spam alert in Splunk that will notify me if we receive excessive emails from a certain source eg 200 emails within a 1 hour timeframe. </P> <P>I was wondering if such an alert can be made and if so some guidance on how to do so.</P> <P>Thanks in Advance</P> Tue, 08 Jan 2013 22:45:58 GMT https://community.splunk.com/t5/Reporting/Spam-Alert/m-p/81505#M1845 Splunker4Life 2013-01-08T22:45:58Z https://community.splunk.com/t5/Reporting/Spam-Alert/m-p/81506#M1846 <P>Sounds like you want to <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Definescheduledalerts">define a scheduled alert</A>.</P> <P>First, figure out the search that will identify spam. Maybe something like this</P> <PRE><CODE>sourcetype=myemail | stats count by mailerDomain | where count &gt;= 200 </CODE></PRE> <P>Then click "Create Alert" from the pull-down menu on the right, and follow the directions in the documentation. The search that I have given would trigger an alert if you used the conditions "number of results &gt; 0"</P> <P>HTH</P> Wed, 09 Jan 2013 02:07:42 GMT https://community.splunk.com/t5/Reporting/Spam-Alert/m-p/81506#M1846 lguinn2 2013-01-09T02:07:42Z